SJensen746423 (Community Member) asked a question.
Why does Greenlight scan not match online scan?
Hello, when we run sandbox scan online this line of code is flagged at a High flaw.
string connectionString = string.Format("Data Source={0}; Initial Catalog={1}; Uid={2}; Password={3}", Config.DatabaseServer, this.InitialCatalog, this.UserName, this.Password);
However, when we scan the exact same source file with Greenlight in Visual Studio that same line is not flagged as a flaw at all. Please help me understand why.
.png){kind=logo}
Hi @SJensen746423 (Community Member) ,
Veracode Greenlight scans single files or packages and may not be able to detect a flaw if it's data originates from other classes this is why we make the following recommendation in our documentation:
> In addition to using Veracode Greenlight, Veracode recommends that you perform a full static analysis scan using the Veracode Platform or the Veracode plugin for your IDE to achieve comprehensive coverage, actionable results, and policy-level reporting to determine application production readiness.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema